(Ubuntu Issues Fix) Apache HTTPD HTTP/2 Request Processing Bug Lets Remote Users Consume Excessive Worker Processes on the Target System
|
|
SecurityTracker Alert ID: 1041799 |
|
SecurityTracker URL: http://securitytracker.com/id/1041799
|
|
CVE Reference:
CVE-2018-1333
(Links to External Site)
|
Date: Oct 4 2018
|
Impact:
Denial of service via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): prior to 2.4.34
|
Description:
A vulnerability was reported in Apache HTTPD. A remote user can consume excessive worker resources on the target system.
A remote user can send specially crafted HTTP/2 requests to cause worker processes to be allocated for 60 seconds longer than required, consuming excessive worker resources on the target system.
Systems configured for and with HTTP/2 support enabled are affected.
Craig Young of Tripwire VERT reported this vulnerability.
|
Impact:
A remote user can consume excessive worker resources on the target system.
|
Solution:
Ubuntu has issued a fix.
The Ubuntu advisory is available at:
https://usn.ubuntu.com/usn/usn-3783-1
|
Vendor URL: usn.ubuntu.com/usn/usn-3783-1 (Links to External Site)
|
Cause:
Resource error
|
Underlying OS: Linux (Ubuntu)
|
Underlying OS Comments: 18.04 LTS
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
